Attacks/Breaches
4/7/2014
01:00 PM
TK Keanini
TK Keanini
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail
50%
50%

If Mother Nature Were A CISO

There are many defensive patterns in nature that also apply to information security. Here's how to defeat your predators in the high-stakes game of corporate survival and resiliency.

People say the Internet is a hostile network (which is true), and that got me thinking about other hostile environments, where a successful strategy results in resiliency and continuity. What if Mother Nature were the CISO? What would her strategy be? What capabilities could she give the prey species, so they could survive in the presence of many predators?

To get a better understanding of the defensive tactics of prey species, it is worth spending a minute talking about the dominant strategies of predators. The three that I'll highlight are cruising, ambush, and the blend of these, which I'll call cruising-ambush. All of these offer similarities to the threat landscape we have been experiencing on the Internet.

  • Cruising: This is where the predator is continually on the move to locate prey. It's a pattern we can see reflected when the adversary broadly scans the Internet for targets. These targets are stationary in the sense that, once a target is found, a connection can be made repeatedly.
  • Ambush: Here the predator sits and waits. This strategy relies on the prey's mobility to initiate encounters. On the Internet today, we see this ambush pattern in a compromised web server sitting and waiting for prey to connect and pull down the exploits. The majority of malware is distributed in this ambush pattern.
  • Cruising-ambush: The blended cruising-ambush is by far the most effective predator pattern. The idea is to minimize exposure when cruising and employ effective ambush resources, which, in turn, cruise and create a loop in the pattern. A few threats exhibit this, such as a phishing campaign that broadly cruises for prey. Once the victim clicks on the phishing link, it quickly shifts to the ambush pattern, with a compromised web server sitting and waiting for the connection to download the malware.

Patterns of prey
There are many documented defensive patterns for prey species, and I'd like to explore the ones that can be applied to Internet security. In all of these cases, Mother Nature's common pattern is making the prey marginally too expensive for the predator to identify and/or pursue.

Certain prey species have raised the cost of observation and orientation so much that they are operating outside their predators' perceptive boundaries. Camouflage is one technique, and another is having parts of the organism be expendable, as in a gecko's tail or a few bees in the colony. Camouflaging can be accomplished in Internet security through cryptography or in the random addressing within a massively large space like IPv6. For the latter, where parts are expendable, one can imagine a front-end system where there are 100 servers behind an application delivery controller (ADC).

Another effective countermeasure to cruising found in nature is the dispersion of targets or the frequent changing of nonstationary targets. This raises the observation and orientation requirements of the predator. If the predator has to do more probing and searching in the reconnaissance phase, it becomes more easily detected.

The last prey species pattern I find useful is one of tolerance to loss. Some species have found a way to divert the predator to eat the non-essential parts and have an enhanced ability to recover rapidly from the damage. Likewise, subsystems should be able to fail, and this failure information be used as inputs to the system for recovery processes.

Species resilience
The game of survival and resiliency is at the level of species and not at the level of organism. Diversity, redundancy, and a high rate of change at the organism level provide stability at the species level. When we look at this pattern in information technology, we can quickly see the need for abstractions. For example, a web server farm of 10 servers (10 organisms) sits behind a load balancer that offers a service (the species).

Abstractions are available to us in our design of these systems, and we need to leverage them in the same way Mother Nature has over the past 3.8 billion years. Virtual servers, software-defined networking, virtual storage -- all the parts are at our disposal to design highly resilient species (services).

Prey species have found a way to establish a knowledge margin with their environment, and this is what we must do with our information systems. The systems you protect must continuously change based on two drivers: how long you think it will take your adversary to perform its reconnaissance and the detection of the adversary's presence. Each time your systems change, the cost for your adversary to infiltrate and, most importantly, to remain hidden is raised substantially, and this is the dominant strategy found in nature.

TK Keanini brings nearly 25 years of network and security experience to the CTO role. He is responsible for leading Lancope's evolution toward integrating security solutions with private and public cloud-based computing platforms. TK is also responsible for developing the ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
4/8/2014 | 11:54:18 AM
Re: Great analogy and analysis
I like the analogy. Now if we only have a few million years to adapt to the predators' tactics, and an unlimited amount of species to sacrifice in the adaptation, plus unlimited funds to maintain pace or overcome those tactics, we should be in good shape ...
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
4/7/2014 | 5:34:56 PM
Great analogy and analysis
Thanks for breaking down the threat landscape in such a vivid and imaginative way, TK! 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?